Fix another leak

src/hb-shape-plan.hh

@@ -55,7 +55,7 @@ struct hb_shape_plan_key_t
 			 unsigned int                   num_coords,
 			 const char * const            *shaper_list);
 
-  HB_INTERNAL void fini () { hb_free ((void *) user_features); }
+  HB_INTERNAL void fini () { hb_free ((void *) user_features); user_features = nullptr; }
 
   HB_INTERNAL bool user_features_match (const hb_shape_plan_key_t *other);
 
@@ -64,6 +64,7 @@ struct hb_shape_plan_key_t
 
 struct hb_shape_plan_t
 {
+  ~hb_shape_plan_t () { key.fini (); }
   hb_object_header_t header;
   hb_face_t *face_unsafe; /* We don't carry a reference to face. */
   hb_shape_plan_key_t key;